Connect other MCP clients to PrompTessor

Any client that supports Streamable HTTP plus the MCP OAuth flow can connect. Configure the endpoint, follow protected-resource and authorization-server discovery, use authorization code with PKCE S256, request the MCP resource audience, and send the resulting Bearer token to the MCP endpoint.

Server URL

https://mcp.promptessor.com/mcp

Transport

Streamable HTTP

Resource

https://mcp.promptessor.com

OAuth issuer

https://auth.promptessor.com

Client type

Public client (token endpoint auth: none)

PKCE

Required, S256

1. 1

   Probe the MCP endpoint

   Send an unauthenticated request to the Server URL. The 401 response includes WWW-Authenticate with the protected-resource metadata URL.

2. 2

   Discover the protected resource

   Fetch https://mcp.promptessor.com/.well-known/oauth-protected-resource. Read its resource, authorization_servers, and scopes_supported values.

3. 3

   Discover the authorization server

   Fetch https://auth.promptessor.com/.well-known/oauth-authorization-server to obtain authorization, token, registration, revocation, and JWKS endpoints.

4. 4

   Register a public client

   Use dynamic client registration when your client does not already have an accepted client ID. Set token_endpoint_auth_method to none and register the exact redirect URI.

5. 5

   Authorize with PKCE

   Start authorization code flow with PKCE S256. Send resource=https://mcp.promptessor.com, the required scopes, state, code_challenge, and code_challenge_method=S256.

6. 6

   Exchange and store tokens

   Exchange the one-time code with the matching code_verifier. Store access and refresh tokens securely; never place them in URLs, source control, or logs.

7. 7

   Initialize MCP

   Send Authorization: Bearer ACCESS_TOKEN to the MCP endpoint, complete initialize, and include the negotiated MCP-Protocol-Version on subsequent requests.

8. 8

   Verify and refresh

   List tools and call get_usage. Refresh the short-lived access token when needed, and use the revocation endpoint when disconnecting the account.

npx @modelcontextprotocol/inspector@latest

The examples below show the wire flow for a public OAuth client. Replace redirect URI, state, verifier, challenge, client id, authorization code, and tokens with your own securely generated values. The token request repeats the resource parameter so the token remains audience-bound to PrompTessor MCP.

curl -i https://mcp.promptessor.com/mcp

curl https://mcp.promptessor.com/.well-known/oauth-protected-resource

curl https://auth.promptessor.com/.well-known/oauth-authorization-server

curl -X POST https://mcp.promptessor.com/mcp \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2025-11-25",
      "capabilities": {},
      "clientInfo": { "name": "example-client", "version": "1.0.0" }
    }
  }'

{
  "jsonrpc": "2.0",
  "id": 4,
  "method": "resources/read",
  "params": { "uri": "promptessor://account/usage" }
}